First work on --buildd.

[blhc/blhc.git] / bin / blhc

diff --git a/bin/blhc b/bin/blhc
index c82e9bc37475987d2bb8610e6c160ec2a9f42fb6..2c439bb0f33003817eb0fd8e1c7be09a33def19a 100755 (executable)
--- a/bin/blhc
+++ b/bin/blhc
@@ -219,6 +219,7 @@ my $option_help    = 0;
 my $option_version = 0;
 my $option_all     = 0;
 my $option_arch    = undef;
+my $option_buildd  = 0;
 if (not Getopt::Long::GetOptions(
             'help|h|?' => \$option_help,
             'version'  => \$option_version,
@@ -228,6 +229,7 @@ if (not Getopt::Long::GetOptions(
             'all'      => \$option_all,
             # Misc.
             'arch'     => \$option_arch,
+            'buildd'   => \$option_buildd,
         )) {
     require Pod::Usage;
     Pod::Usage::pod2usage(2);
@@ -270,6 +272,26 @@ my $start = 0;
 my $continuation = 0;
 my $complete_line = undef;
 while (my $line = <>) {
+    # dpkg-buildflags only provides hardening flags since 1.16.1, don't check
+    # for hardening flags in buildd mode if an older dpkg-dev is used. Default
+    # flags (-g -O2) are still checked.
+    #
+    # Packages which were built before 1.16.1 but used their own hardening
+    # flags are not checked.
+    if ($option_buildd and not $start
+            and $line =~ /^Toolchain package versions: /) {
+        require Dpkg::Version;
+        if ($line !~ /dpkg-dev_(\S+)/
+                or Dpkg::Version::version_compare($1, '1.16.1') < 0) {
+            $harden_format  = 0;
+            $harden_fortify = 0;
+            $harden_stack   = 0;
+            $harden_relro   = 0;
+            $harden_bindnow = 0;
+            $harden_pie     = 0;
+        }
+    }
+
     # We skip over unimportant lines at the beginning to prevent false
     # positives.
     $start = 1 if $line =~ /^dpkg-buildpackage:/;
@@ -492,6 +514,7 @@ B<blhc> [--pie] [--bindnow] [--all]
     --bindnow               force +bindbow check
     --all                   force +all (+pie, +bindnow) check
     --arch                  set architecture (autodetected)
+    --buildd                parser mode for buildds
 
 =head1 DESCRIPTION
 
@@ -529,6 +552,20 @@ Set the specific architecture (e.g. amd64, armel, etc.), automatically
 disables hardening flags not available on this architecture. Is detected
 automatically if dpkg-buildpackage is used.
 
+=item B<--buildd>
+
+Special mode for buildds when automatically parsing log files. The following
+changes are in effect:
+
+=over 2
+
+=item
+
+Don't check hardening flags in old log files (if dpkg-dev << 1.16.1 is
+detected).
+
+=back
+
 =back
 
 Auto detection for B<--pie> and B<--bindnow> only works if at least one